Analysis
-
max time kernel
148s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-04-2024 01:30
General
-
Target
SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf
-
Size
23KB
-
MD5
b97106bf094029ad01e7e9ae85a21546
-
SHA1
c39cc1ff0f8fd1180dda4d14794865242e10643b
-
SHA256
32d6aff2c09b262b2d82759a2e8240d248d78836024f7197692c155c21c490ec
-
SHA512
6aaf8e04298a54ee53214ce3b1a6c5eeae4966a8278d5a897318252af267fa308191ed0c1a9ae27f20fabd7b3937a4f58598323fab13085221ed4f58303fa13f
-
SSDEEP
384:M5B6Yj833S7YSpsGE0m1SAqMaECTS2llsFMP3mrXcTc5cb5rFldGSzwv01JZie5A:M3j8tB0m1SAiTxv0qmrMQ8dGCwv1eFY
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elfdescription ioc process File opened for modification /dev/watchdog SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for modification /dev/misc/watchdog SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 1 TTPs 2 IoCs
Processes:
SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elfdescription ioc process File opened for modification /bin/watchdog SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for modification /sbin/watchdog SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elfdescription ioc process File opened for reading /proc/965/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1067/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1192/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1262/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/608/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1260/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1038/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/740/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1136/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1201/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1355/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1588/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/489/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1278/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1636/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/466/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/661/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/981/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1314/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/432/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/526/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1091/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1203/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/415/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/483/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1540/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1576/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1568/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/419/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/498/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/644/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/655/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/658/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1198/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1019/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/562/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/733/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1104/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1542/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1594/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/527/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1095/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1160/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1173/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1543/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1549/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/554/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/957/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/963/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/974/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1124/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1473/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1600/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/457/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/505/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1128/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1155/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1338/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1044/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1083/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1140/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/1388/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/497/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf File opened for reading /proc/673/cmdline SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1546-1-0x0000000008048000-0x00000000080558e8-memory.dmp